# BaseFlasher transfers tokens and then calls xBundle(...), so the sent tokens can't be returned due to the balance check Medium · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-M04 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description The BaseRouter checks if the balances of the assets remain the same after the xBundle(...) execution. The BaseFlasher, _requestorExecution(...) is implemented in the following way ```solidity IERC20(asset).safeTransfer(requestor, amount); requestor.functionCall(requestorCalldata); // approve flashloan source address to spend to repay flashloan IERC20(asset).safeApprove(getFlashloanSourceAddr(asset), amount + fee); ``` Thus, when xBundle(...) is called in requestor.functionCall(requestorCalldata);, the initial balance of the BaseRouter will take into account the received funds from the flashloan, such that it will be impossible to return the funds at the end of the call. ### Recommendation Similarly to xReceive(...) of the ConnextRouter, the BaseRouter could implement a similar function. In this case, the caller of, let's say, flashloanReceive(...), could be whitelisted to one of the flashers. ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCCantUseFlashloanFunds.t.sol#L97 ### Status Addressed here: [Fujicracy/fuji-v2#622](https://github.com/Fujicracy/fuji-v2/pull/622) --- Related findings: - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [Signer duplicate check can be performed by requiring signers being sent ordered](https://0xsimao.com/findings/orange-signer-requiring-signers-ordered): Orange Bridge - [Unnecessary user balance check in _withdrawRequest()](https://0xsimao.com/findings/glacier-unnecessary-balance-withdraw-request): Glacier - [Balance check in Vault::withdraw() does not take fees into account](https://0xsimao.com/findings/orange-balance-withdraw-fees-account): Orange Bridge